Unstructured Data

In some cases there may not be an adequate data structure for capturing the content of a field. In these cases data can be captured using the <Data> element content model, see the following example.

<EventDetail>
  <Data Name="infoKey" Value="Info"/>
  <Data Name="otherInfoKey" Value="OtherInfo"/>
</EventDetail>

<Data> elements can be nested to indicate hierarchy if necessary and can be included within many of the predefined data structures, for example.

<EventDetail>
  <Data Name="user" Value="Flack">
    <Data Name="role" Value="manager"/>
    <Data Name="staff">
      <Data Name="user" Value="Cuthbert">
        <Data Name="role" Value="underling"/>
        <Data Name="staff"/>
      </Data>
      <Data Name="user" Value="Dibble">
        <Data Name="role" Value="underling"/>
        <Data Name="staff"/>
      </Data>
      <Data Name="user" Value="Grub">
        <Data Name="role" Value="underling"/>
        <Data Name="staff"/>
      </Data>
    </Data>
  </Data>
</EventDetail>

Extensive use of the unstructured Data elements can lead to difficulties in processing events unless the name and value attributes have been used in a consistent way. Their use may highlight the need for changes to the schema so that the data can be captured in a common and consistent way. They can however by useful for capturing detailed domain/system specific information about an event that you would not expect to search on but that could provided extra detail if the event is included in search results.